Assessing the Risks of Cyber Terrorism, Cyber War and Other Cyber Threats:
James A. Lewis
Center for Strategic and International Studies
December 2002
Cyber-warfare conjures up images of information warriors unleashing vicious attacks against an unsuspecting opponent’s computer networks, wreaking havoc and paralyzing nations. This a frightening scenario, but how likely is it to occur? What would the effects of a cyber attack be on a potential opponent?
Cyber attacks, network security and information pose complex problems that reach into new areas for national security and public policy. This paper looks at one set of issues – those related to cyber-terrorism and cyber attacks on critical infrastructure and their implications for national security. Cyber-terrorism is “the use of computer network tools to shut down critical national infrastructures (such as energy, transportation, government operations) or to coerce or intimidate a government or civilian population.” The premise of cyber terrorism is that as nations and critical infrastructure became more dependent on computer networks for their operation, new vulnerabilities are created – “a massive electronic Achilles' heel.” A hostile nation or group could exploit these vulnerabilities to penetrate a poorly secured computer network and disrupt or even shut down critical functions. Much of the literature on cyber-terrorism assumes that the vulnerability of computer networks and the vulnerability of critical infrastructures are the same, and that these vulnerabilities put national security at a significant risk. Given the newness of computer network technology and the rapidity with which it spread into economic activity, these assumptions are not surprising. A closer look at the relationships between computer networks and critical infrastructures, their vulnerability to attack, and the effect on national security, suggests that the assumption of vulnerability is wrong. A full reassessment is outside the scope of this paper, but a brief review suggests that while many computer networks remain very vulnerable to attack, few critical infrastructures are equally vulnerable.
A reassessment of the cyber threat has four elements. First, we need to put cyber-warfare and cyber-terrorism in the historical context of attacks against infrastructure. Strategies that emphasize attacks on critical civil infrastructures have discussed for more than eighty years. Second, we need to examine cyber attacks against a backdrop of routine infrastructure failures. There is extensive data on power outages, flight delays and communications disruptions that occur normally and the consequences of these routine failures can be used to gage the effect cyber-warfare and cyber-terrorism. Third, we need to measure the dependence of infrastructure on computer networks and the redundancy

 CSIS, 2002

1

already present in these systems. Finally, for the case of cyber-terrorism, we must consider the use of cyber-weapons in the context of the political goals and motivations of terrorists, and whether cyber-weapons are likely to achieve these goals.
A preliminary review of these factors suggests that computer network vulnerabilities are an increasingly serious business problem but that their threat to national security is overstated. Modern industrial societies are more robust than they appear at first glance.
Critical infrastructures, especially in large market economies, are more distributed, diverse, redundant and self-healing than a cursory assessment may suggest, rendering them less vulnerable to attack. In all cases, cyber attacks are less effective and less disruptive than physical attacks. Their only advantage is that they are cheaper and easier to carry out than a physical attack.
Infrastructure as Target
Cyber-terrorism is not the first time a new technology has been seized upon as creating a strategic vulnerability. While the match between theories of cyber-warfare and air power is not precise, a